Validation of Mixed Signal-Alpha Real-Time Systems through Affine Calculus on Clock Synchronisation Constraints

HAL Id: hal-00548887

https://hal.archives-ouvertes.fr/hal-00548887

Submitted on 20 Dec 2010

HAL is a multi-disciplinary open access archive for the deposit and dissemination of sci- entific research documents, whether they are pub- lished or not. The documents may come from teaching and research institutions in France or abroad, or from public or private research centers.

L’archive ouverte pluridisciplinaire HAL, est destinée au dépôt et à la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d’enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Validation of Mixed Signal-Alpha Real-Time Systems through Affine Calculus on Clock Synchronisation

Constraints

Irina Smarandache, Thierry Gautier, Paul Le Guernic

To cite this version:

Irina Smarandache, Thierry Gautier, Paul Le Guernic. Validation of Mixed Signal-Alpha Real-Time Systems through Affine Calculus on Clock Synchronisation Constraints. World Congress on Formal Methods in the Development of Computing Systems (FM’99), Sep 1999, Toulouse, France. pp.1364- 1383, �10.1007/3-540-48118-4_22�. �hal-00548887�

Validation of Mixed

-

Real-Time Systems through Ane Calculus on Clock

Synchronisation Constraints

Irina M. Smarandache

, Thierry Gautier

, and Paul Le Guernic

1

The University of Reading, Department of Computer Science Whiteknights, PO Box 225, Reading RG6 6AY, United Kingdom

Tel.: (44) 118 931 8611 (7626), Fax: (44) 118 975 1994

I.M.Smarandache@reading.ac.uk

2

IRISA-INRIA, Campus de Beaulieu, 35042 Rennes Cedex, France

Thierry.Gautier@irisa.fr, Paul.LeGuernic@irisa.fr

Abstract.

In this paper we present the ane clock calculus as an exten- sion of the formal verication techniques provided by the

lan- guage. A

program describes a system of clock synchronisation constraints the consistency of which is veried by compilation (clock cal- culus). Well-adapted in control-based system design, the clock calculus has to be extended in order to enable the validation of

-

ap- plications which usually contain important numerical calculations. The new ane clock calculus is based on the properties of ane relations in- duced between clocks by the renement of

-

specications in a codesign context. Ane relations enable the derivation of a new set of synchronisability rules which represent conditions against which syn- chronisation constraints on clocks can be assessed. Properties of ane relations and synchronisability rules are derived in the semantical model of traces of

. A prototype implementing a subset of the synchro- nisability rules has been integrated in the

compiler and used for the validation of a video image coding application specied using

and

.

1 Introduction

Real-time systems, and more generally reactive systems [4], are in continuous interaction with their environment. Therefore, they must respond in time to external stimuli. Moreover, real-time systems must be safe, thus one would wish to prove their correctness. Time constraints and safety are two important aspects to be considered in the design of a real-time application.

Real-time systems may be constrained by very tight real-time deadlines.

Moreover, a hardware implementation of parts of these systems is sometimes

required, to meet specic constraints for instance. An example is an application

consisting of numerical calculations performed iteratively on large structures of

regular multidimensional data. In this case, a hardware/software implementation

may be envisaged, in which the numerical calculations are conveyed to hardware

for eciency reasons, while the control relating these parts is implemented in software.

In general, designing a mixed hardware/software real-time system requires a rigorous methodology that comprises methods and tools addressing, among oth- ers, system specication and validation, optimal code generation and hardware synthesis. These aspects are dealt with in codesign [7] [9] which denotes the spec- ication, validation and implementation of an application which consists both of a hardware part, in the form of a set of specialised integrated circuits, and a software part implemented on general programmable processors. The idea is to explore various possible implementations of hardware/software systems in order to improve their performance and to ensure the respect of cost constraints.

1.1 Real-Time System Codesign

System codesign is a complex process which can be decomposed into three main activities [7]: 1. The cospecication of an application at various levels of abstrac- tion; 2. The validation of a specication by formal verication or simulation, also known as cosimulation; 3. The hardware/software partitioning of an application, the evaluation of a partitioning from the point of view of the time constraints and cost, the generation of executable code, the synthesis of hardware, and the production of the interface between hardware and software, i.e cosynthesis. A lot of work has been done, the purpose of which was to dene a well-structured methodology for codesign [7] [11] [19]. An important point was generally the description of both hardware and software using the same language, like for in- stance

enhanced with mechanisms for calling

functions [14], or high-level languages like

,

or

extended with facilities for the description of hardware systems [10]. These approaches enable the programming of both the hardware and software parts of a system in a unique framework and their vali- dation by simulation. However, they cannot guarantee system correctness. This aspect can be much improved by using formal languages for system specication, renement of specications towards lower levels of abstraction (implementation) and validation of the various specications by formal verication.

Dening a complete methodology of codesign requires addressing other rel- evant problems, most of them concerning cosynthesis. Among these problems there are the automatic partitioning into hardware and software, the synthesis of hardware and the generation of optimal code for software implementation.

The work presented in this paper is part of a more general eort for building a hybrid framework in which the

[12] [13] and

[20] languages can be used for real-time system codesign.

1.2 Cospecication and Cosimulation of

-

Systems

Signal

is a synchronous [4] language developed for the specication, validation

and implementation of real-time systems.

variables represent nite or

innite sequences of values (data) which can be ltered or merged before being

submitted to classical boolean or mathematical operations. A clock is implicitly

associated with each

variable: it represents a set of temporal indices which denote the logical instants where the variable is present and has a value.

The semantics of a

program can be described by a system of constraints (relations) on clocks and values, which is constructed and veried for consistency during compilation. The verication of the clock constraints is called clock cal- culus. The

environment is enhanced with tools for

[5] and

[3]

code generation and formal verication of dynamic properties [2].

In its present form,

is well-adapted for the design of control-based real-time systems. Firstly, this is due to its limitations concerning the treatment of computations on multidimensional data such as matrices. Only simple algo- rithms can be expressed in

and no signicant optimisation is performed at the level of the generation of executable

or

code concerning vectors.

In contrast with

, the

language has been developed primarily for the specication and implementation of algorithms on multidimensional data.

Such algorithms can be described in

using ane recurrence equations over convex polyhedral domains [20] and be further transformed for optimal hardware or software implementation on parallel or sequential architectures [21].

Given their complementary properties, the

and

languages can be used jointly for the design of real-time systems containing important numerical calculations on multidimensional data and control: numerical compu- tations are expressed in

and the control is conveyed to

. When the real-time requirements of the system are very tight, a mixed hardware/software implementation may be envisaged. In [9] we propose a hybrid framework for the combined use of

and

in real-time system codesign. In order for this framework to be operational, it is necessary to interface

and

programs both at the functional and architectural level. The former corresponds to a high-level mathematical representation of an algorithm in

, while the latter contains a set of new temporal indices corresponding to the execution of the algorithm on a parallel or sequential architecture.

In

-

systems, the renement of an

program from a functional level to an architectural level oriented toward a particular implemen- tation also induces a renement of the temporal indices in

. The new time indices are obtained through ane transformations on the instants of time of the initial

specication. Consider clocks

and

in

which are identical at the functional level (they are also denoted as synchronous). Af- ter renement, their relative position is such that clock

can be obtained by an ane transformation applied to clock

: the instants of time of

and

, denoted respectively

and

, can be described by a pair of ane functions

T

=

+

,

=

+

, on the same set of instants

. With

=

, we will say that clock

is obtained by an (

)-ane transformation applied to clock

, where

IIN

the set of strictly positive integers and

Z the set of integers. Clocks

and

are also said to be in an (

)-ane relation.

Clocks obtained by ane transformation may be re-synchronised at the ar-

chitectural level. As an example, consider clocks

,

and

which are identical

in the

functional specication. At the architectural level, clocks

and

c

2

have been transformed such that

,

and

,

are respectively in ane relations of parameters (

) and (

). Whether clocks

and

can be re-synchronised depends on the properties of the ane relations which are induced from the values of (

) and (

). Moreover, the rela- tions between

,

and respectively,

,

may be expressions on (

)-ane relations constructed using operations like composition, union, etc. In this case, the re-synchronisation of clocks

and

depends on the properties of these operations.

The

clock calculus performs the verication of clock synchronisation constraints using a set of synchronisability rules, i.e. conditions against which these constraints can be assessed. The current clock calculus depends on boolean equation resolution methods [5] [1] which have been successfully used for the val- idation of numerous control-based real-time applications. However, in order to validate mixed

-

systems as presented above, it is necessary to ex- tend the current clock calculus with a set of synchronisability rules deduced from the properties of (

)-ane relations. The new set of rules denes the ane clock calculus, which constitutes the main topic of this paper. We explore the space of (

)-ane relations and study to which extent it is closed under the main operations that can be performed on ane relations. Following this study, we dene a set of synchronisability rules which, although incomplete, enables the validation of the principles underlying the cospecication and cosimulation using

and

. The semantical model of traces of

[12] [16]

constitutes the support for the study of the properties of ane relations and for the denition of the new synchronisability rules.

1.3 Organisation of the Paper

In Section 2 we present the integration of

and

for system code- sign. Section 3 is the central core of this paper and is dedicated to the denition and implementation of the ane clock calculus. The main concepts useful for this purpose are progressively introduced: these are the model of traces of the

Signal

language, the properties of ane relations on clocks, the set of synchro- nisability rules induced by the latter, and nally the necessary elements for the integration of the ane clock calculus in the compiler. The ane clock calculus has been applied to the cospecication and cosimulation of a video image coding application; this is briey illustrated in Section 4. In the same section we discuss in which way the

and

environments may further contribute to the development of a complete codesign methodology based on both languages.

Finally, in Section 5 we present conclusions and perspectives of our work.

2

and

in Real-Time System Codesign

Figure 1 summarizes the main elements of the environments around

and

Alpha

that make both languages well-adapted for real-time system codesign.

Signal

and

programs represent mathematical notations for the proper- ties of the processes they dene. The system of constraints on clocks and values associated with a

program is transformed by compilation into a synchro- nised data ow graph (

). This data structure constitutes the support for executable code generation (

or

) or verication of dynamic properties using the formal tool

[2].

The

compiler includes a powerful type checking mechanism based on the structure of an

variable as a function over convex polyhedra. The syntax tree obtained after compilation can be directly translated into

code for functional simulation, or it can be transformed into a subset of

called

pha0

which exhibits the details of a parallel or sequential implementation. The syntax tree in

form can be further translated in

or

executable code or directly mapped on a netlist [21].

The interface between

and

is based on the fact that both languages can be translated in

and executed for functional simulation. Fur- thermore,

oers the possibility to call external processes: such a process can be the specication of an algorithm in a language other than

. A particular type of an external process is a function, the execution of which is considered instantaneous from the point of view of

. A

function can be a predened or a user-dened

function.

Fig.1.Signal

and

in system codesign.

2.1 Functional Cospecication and Cosimulation

Being a synchronous language,

is based on the following hypotheses [4]:

1. All actions (communications and calculations) in a system have zero logical

duration (the elapsed time is represented by the precedence of successive values on a same data ow); 2. Two or more actions can take place at the same logical instant, such actions being termed \simultaneous". From the point of view of the logical temporal properties of a system, only succession and simultaneity of instants are of interest. Although their exact time values are not considered, note however that they will be considered for a given implementation. The pro- cess associated with a

program represents thus a succession of logical instants, with each instant being associated one or more actions considered of zero logical duration and involving process variables present at that instant.

Consider for example a coding system for sequences of video images at 34 Mbits/s [8]. A system of this type consists of a set of numerical treatments applied iteratively on images of the same dimension. Images are divided into luminance and chrominance blocks and treatments are applied to each block.

Numerical treatments consist mainly of algorithms for inter and intra image coding which require operations like a discrete cosine transformation (

). In order to illustrate the interfacing between

and

, we have isolated from the coding application a simple

program and have illustrated the associated process in Fig. 2. It consists of a

operation applied in sequence to dierent values

of the matrix of pixels

present at each logical instant of time

t

i

. The matrix

corresponds to a block of luminance or chrominance of an image.

The

can be expressed in

as

:=

(

), where

is actually an external process. The

is a time consuming algorithm, particularly for large matrices or when applied to images containing a large number of blocks. In order to improve the overall performance of the coding application, one would wish to execute each instance

:=

(

) on a parallel integrated architecture as derived by the

environment.

The

can be easily described in

. The

-

cospecica- tion and cosimulation of the new system is made possible at the functional level as follows (see Fig. 2): 1. The

system is translated in executable

code;

2. The

function ALPHA C obtained at step 1 represents the external process implementing the

in

. The function ALPHA C is considered instan- taneous in

; the clocks of the matrices

and

, denoted respectively by

c

and

, are therefore synchronous. The overall system is thus represented as a

specication executing instantaneously the functional description of the

specication. The system can be validated in the

environ- ment by formal verication (compilation, model checking with

) and/or simulation.

2.2 Implementation-oriented Cospecication and Cosimulation

A mixed

-

specication at the functional level may be rened in order to take into consideration the details of a particular implementation. The

Alpha

program of Section 2.1 describing a

may be submitted to a sequence

of transformations for a parallel or sequential implementation. These transfor-

mations guarantee the equivalence of the nal specication, noted ALPHA' in

Fig. 3, with the initial ALPHA system of Fig. 2. The system ALPHA' contains

Fig.2.Signal

-

interface at functional level.

the time indices corresponding to a particular scheduling of the

operation.

In Fig. 3 these time indices are represented as the diagonal sets of micro-instants

t j

i

associated with each macro-instant

.

The

specication has to be rened accordingly in order to enable the validation of the overall system. Therefore, the micro-instants of time of ALPHA' are taken into consideration in the new process SIGNAL' and described as the sets of instants

,

, etc. (see Fig. 3). The

function ALPHA' C has been derived from ALPHA' and transformed in order to describe the sequence of operations performed at each micro-instant of time.

Fig.3.Signal

-

interface at architectural level.

The regularity of

values manifests itself in

in several ways.

First, the sets of micro-instants

,

, etc. have the same cardinality. Also, successive values for

are provided at specic micro-instants between any two successive macro-instants

and

in a regular manner. This situation is il- lustrated in Fig. 4 where the clocks of matrices

and

, denoted respectively by

and

, are dened by the following instants of time:

=

0

9

18

and

c

1

=

6

15

(after providing the values

at the instants of time dened by

c

1

, the architecture implementing the operation

:=

(

) may execute fur-

ther computations like initialisations for the next operation

:=

(

)).

Fig.4.

Illustration of an ane relation.

In Fig. 4, clock

is dened by the set of instants

0

1

2

3

4

5

. It can be noticed that clocks

and

are placed in a regular manner on the sup- port clock

: their relative position is such that

has been obtained through an (9

6

9)-ane transformation applied to

. By denition, clock

is the re- sult of an (

)-ane transformation applied to clock

if it can be obtained from

through steps 1 and 2 as follows: 1. Constructing a new clock

as the union of

with the set of instants obtained by introducing

1 ctive in- stants between any two successive instants of

(and

ctive instants before the rst instant of

when

is negative). 2. Dening the clock

as the set of instants

+

, with

=

IIN

(in other words, counting ev- ery

instant, starting with the

instant of

, or with the rst instant of

c

0

when

is negative). Clocks

and

are then said to be in an (

)- ane relation. The above denition can be expressed in an equivalent form as follows: clocks

and

are in (

)-ane relation if there exists a clock

c

0

such that

and

can be respectively expressed using the ane functions

t:

(

+

) and

(

+

), with

=

, with respect to the time in- dices of

:

=

IIN

,

=

+

,

=

+

.

Properties on ane relations can be exploited in order to verify that clocks are synchronisable, that is, their sets of instants can be identied (re- synchronised). Consider (Fig. 2) a

program which executes two succes- sive

operations at each macro-instant

, one on a luminance block of an image, noted

:=

(

), and the second one on the next block of red chromi- nance of the same image, described by

:=

(

).

Each

function is expressed in

at the functional level and further rened according to a particular implementation. The

specication is rened accordingly and we obtain the timing diagrams of Fig. 5: the clocks of

and

are synchronous and equal to

, the clocks of

and

are respectively

c

1

and

, and the clocks

and

describe the instants of the excution of the

Dct

functions on a potential architecture derived in the

environment.

In the functional

-

specication, clocks

,

and

were syn-

chronous (see Section 2.1 for details). After renement of the time indices in

the

-

specication, the clocks

and

should be re-synchronised

in order to preserve the temporal properties of the whole application. Whether

the re-synchronisation of

and

is possible given their relative position as

illustrated in Fig. 5, or after further adjustments of their time indices, can be

decided based on the properties of the ane relations existing between

,

Fig.5.

Synchronisable clocks in the context of codesign with

and

. and

,

respectively. Clocks

,

and

,

are respectively in (9

6

9) and (7

3

7)-ane relation in the process SIGNAL'. The relation existing between the triplets (9

6

9) and (7

3

7) guarantees the equivalence of the corresponding ane relations. This will be detailed in Section 3. Informally, the equivalence of the above ane relations expresses the fact that the relative positions of clocks

c

and

, respectively

and

, are identical. Based on this observation, clocks

c

1

and

can be identied without contradicting the temporal behaviour of the other clocks in the

program. The instants of time of clocks

and

situated between two successive instants of

and

(or

) are independent and can be positioned with respect to each other in various manners; in Fig. 5 we have illustrated one possibility. Therefore,

and

can be re-synchronised; we say that

and

are synchronisable.

The aim of the ane clock calculus discussed in Section 3 is to dene neces- sary and sucient conditions for clock synchronisability based on the properties of ane relations on clocks. These conditions are expressed as a set of synchro- nisability rules and are derived in the semantical model of traces of

. Section 3 begins with an introdution to these concepts.

3 Ane Calculus on Clocks in

Figure 6 introduces the reader to the semantics of traces [12] [16] of

. The most important concepts in

are: 1. the signal, which denotes a variable of the language and represents a nite or innite sequence of values;

2. the clock, a variable associated with each signal which represents the set of

logical instants where the values of the signal are present.

operators

manipulate signals by imposing implicit or explicit constraints on their values

and clocks. Constraints on clocks are usually expressed as identities between

clock expressions constructed using the operators of intersection (

), union (

) or dierence (

). Clocks can be also subsets of other clocks dened as samplings by boolean conditions. When no condition is explicitly or implicitly stated on a pair of clocks, they are independent.

Fig.6.

Illustration of

semantics of traces.

A

program describes a real-time system, which is in continuous inter- action with its environment. Input values are transformed corresponding to the actions of a given specication and the results are provided to the environment.

This situation is illustrated in Fig. 6 in the case of a program manipulating in- puts

and

and providing output

depending on the values of

and

. In case

z

is the addition of

and

, signals

,

and

are implicitly constrained by the + operator in

to have the same clocks

=

=

.

The congurations

and

illustrated in Fig. 6 correspond to two dierent executions of the

program, involving sequences

,

and

and respec- tively

,

and

. The set of all possible congurations, called traces, which can be exhibited during the execution of a

program, denes completely the process

associated with the program. Consider

a subset of the set

of signals manipulated by a program. A trace may contain instants with no action involving signals from

. However, each instant of this type contains actions which involve other signals from the set

. Given a subset

of signals, a ow on

is a trace with at least one action involving signals from

for each logical instant. In the particular case of Fig. 6, if we consider the subset of signals to be

, the traces illustrated are actually ows.

More generally, the process

associated with a

program is a set of

ows on the variables of the program. Each ow

in

is constrained by a system

of equations on the clocks and values of signals manipulated by

. Equations

on values can be further expressed in the abstract form of a data dependency

graph (an example of a data dependency graph is illustrated in Fig. 6 for the +

operator). Besides the clock calculus, the compiler veries data consistency by checking the absence of cycles in the data dependency graph. In the next section however, we will concentrate mainly on the clock calculus.

3.1 Clock calculus & Synchronisability

The clock calculus is equivalent to the resolution of a system of clock equations.

For example:

c

=

c

0

= (

)

c

=

(1)

can be a system derived from a

program which manipulates clocks

,

,

c

1

and

. In this simple system,

and (

)

have clearly to be proved equivalent, which is an immediate consequence of the axioms of the boolean lattice. The space of clocks associated with a

program is a boolean lattice [6] the properties of which are extensively used for the proof of equivalences. The resolution of the system is performed by triangularisation of the system [5] [1].

Given a boolean signal

, its clock, denoted ^

, can be partitioned into the clock [

] where the signal

is present and true and the clock [

] where

is present and false (the clocks [

] and [

] represent samplings by boolean conditions). The relations between clocks ^

, [

] and [

] are expressed by the partition equations below:

[

]

[

] = ^

[

]

[

] =

(2)

The axioms of the boolean lattice together with the partition equations induce on the space of clocks a lattice of an order

\coarser" than the order

of the boolean lattice [5]. Clocks can be boolean formulas constructed either with samplings by boolean conditions [

], [

] or with free variables of the boolean lattice. The properties of the lattice of order

are actually used during the triangularisation of any system of clock equations.

The axioms of the lattice

represent a system of synchronisability rules in the sense described below. Clocks

and

are synchronisable in the process

, which is denoted by

, if there exists a ow

in

in which

and

are synchronous:

c P

c 0

,9F 2P;c

=

(3)

(we note

=

the fact that

and

are synchronous in

).

Whenever the property expressed by equation 3 is valid for each ow

in

, the clocks

and

are said to be synchronous in

, which is denoted by

=

. This denition can be expressed as follows:

c

=

=

(4)

Unless explicitly constrained through the

program, clocks

and

are completely independent in the associated

process. Therefore, their relative position can be such that in some ows

in

they are identical, while in some other ows

in

their instants interleave in an arbitrary manner: obviously, if

and

are independent in

, they are synchronisable. When the relative position of clocks

and

is implicitly or explicitly constrained by the

operators, ows

in

are subsequently constrained and the synchronisability of

and

depends on these constraints.

In order to better understand the use of the synchronisability rules, consider for example a process

derived from a

program Prg in which clocks

and

are dened by the rst two equations of the system (1):

c

=

c

0

= (

)

(5)

Program Prg may be transformed into Prg

in which an additional constraint has been expressed on clocks

and

:

=

(in the

-

context, Prg could be part of a transformed

-

specication, as seen above, and Prg

the same specication, in which clocks are resynchronised). Consider the process

corresponding to the program Prg

. The system of clock equations associated with Prg

is (1). Given the set of ows

such that

=

,

8F 2F

0

, it results

=

. Therefore, verifying the consistency of (1), which is equivalent to testing that clocks

and

are equivalent in

, is further equivalent to testing the synchronisability of

and

in

. The rule (

)

=

from the boolean lattice is indeed a synchronism rule: (

)

=

for every process

. The same axiom holds for the process

associated with Prg. And thus (

)

, since synchronism implies synchronisability. Therefore in the example,

is not empty and it can be concluded that

is consistent from the point of view of the constraints expressed on its clocks.

The rules of the lattice

represent synchronisability rules: each identity

f

1

=

, with

,

boolean formulas on clocks, is equivalent to

=

which implies

for every process

. These rules can be further extended using the properties of the ane relations between clocks. Figure 5 illustrates this idea:

if

is the process associated with the program SIGNAL', the conguration in which clocks

and

coincide represent a ow

such that

=

. Thus,

and

are synchronisable in

. The reason here is that the (9

6

9) and (7

3

7)- ane relations existing respectively between

,

and

,

are equivalent. In the next section, we dene the ane relation associated with a ow and a process and further explicitate the concept of equivalence of ane relations.

3.2 Ane Relations in

Given

IIN

and

Z xed, clocks

and

are in (

)-ane relation in

the ow

|which is denoted

or (

)

|if the relative

position of

and

in

can be induced by an (

)-ane transformation as dened in Section 2.2.

Clocks

and

are in (

)-ane relation in process

, denoted

c R P

(n;';d) c

1

or (

)

, if they are in (

)-ane relation in each ow

of

, i.e.

,

. Flows and processes are dened over the set of variables they manipulate. For a given set

, a ow

on

is a member of the set of ows

that can be constructed with the variables of

. In a similar manner, a process

on

belongs to the set of processes on

, i.e.

. Because of the nite nature of the sets of variables associated with ows and processes, ane relations can be dened as nite sets as follows:

8F 2F

A

;R F

(n;';d)

=

(

)

(6)

8P 2F

A

;R P

(n;';d)

=

(

)

(7) Consider the process

dened as follows:

P

=

(8) (induced by a

program that manipulates only the clocks

,

and

).

From the denition of an ane relation associated with a process it results

c R P

(n

1

;'

1

;d

1 )

c

1

and

;'

2

;d

2 )

c

2

. Clocks

and

are synchronisable in

if there exists

satisfying

=

. Consider

satisfying

=

. Obviously

and

. Being identical in

, clocks

and

can be replaced with each other and therefore

implies

c R F

s

(n1;'1;d1) c

2

and

implies

. It results therefore that

=

=

(

)

(

)

. In conclusion, a necessary con- dition for clocks

and

to be synchronisable in

is that

and

R F

s

(n2;'2;d2)

be equivalent. In the case of the process

dened by (8), it can be proved that this condition is also sucient.

The equivalence of ane relations depends on the closure properties of the space of ane relations with respect to the main operations that can be applied to it. These are either union, intersection or dierence induced by the homonym operations on clocks, or general operations on relations like inverse and com- position [15]. In the next section we propose a study of these properties in the semantical model of traces of

.

3.3 Properties on Ane Relations & Synchronisability Rules

The semantics of traces. Consider a nite set of signals

. The set of all

possible ows dened on

is denoted

. Subsets of ows from

can be

grouped in processes which are members of the set

of all processes that can

be dened on

. A

program on

denes a process

; each ow